OSModifier: Extend EMU API to update verity and root device

toolkit/tools/osmodifierapi/os.go

@@ -20,6 +20,8 @@ type OS struct {
 	KernelCommandLine imagecustomizerapi.KernelCommandLine `yaml:"kernelCommandLine"`
 	Services          imagecustomizerapi.Services          `yaml:"services"`
 	Modules           imagecustomizerapi.ModuleList        `yaml:"modules"`
+	Verity            *Verity                              `yaml:"verity"`
+	RootDevice        string                               `yaml:"rootDevice"`
 }
 
 func (s *OS) IsValid() error {
@@ -76,5 +78,11 @@ func (s *OS) IsValid() error {
 		return err
 	}
 
+	if s.Verity != nil {
+		if err := s.Verity.IsValid(); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }

toolkit/tools/osmodifierapi/verity.go

@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+package osmodifierapi
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/microsoft/azurelinux/toolkit/tools/imagecustomizerapi"
+)
+
+var (
+	verityNameRegex = regexp.MustCompile("^[a-z]+$")
+)
+
+type Verity struct {
+	// ID is used to correlate `Verity` objects with `FileSystem` objects.
+	Id string `yaml:"id"`
+	// The name of the mapper block device.
+	// Must be 'root' for the rootfs (/) filesystem.
+	Name string `yaml:"name"`
+	// The ID of the 'Partition' to use as the data partition.
+	DataDeviceId string `yaml:"dataDeviceId"`
+	// The ID of the 'Partition' to use as the hash partition.
+	HashDeviceId string `yaml:"hashDeviceId"`
+	// How to handle corruption.
+	CorruptionOption imagecustomizerapi.CorruptionOption `yaml:"corruptionOption"`
+}
+
+func (v *Verity) IsValid() error {
+	if v.Id == "" {
+		return fmt.Errorf("'id' may not be empty")
+	}
+
+	if !verityNameRegex.MatchString(v.Name) {
+		return fmt.Errorf("invalid 'name' value (%s)", v.Name)
+	}
+
+	if v.DataDeviceId == "" {
+		return fmt.Errorf("'dataDeviceId' may not be empty")
+	}
+
+	if v.HashDeviceId == "" {
+		return fmt.Errorf("'hashDeviceId' may not be empty")
+	}
+
+	if err := v.CorruptionOption.IsValid(); err != nil {
+		return fmt.Errorf("invalid corruptionOption:\n%w", err)
+	}
+
+	return nil
+}

toolkit/tools/pkg/imagecustomizerlib/customizeverity.go

@@ -122,7 +122,7 @@ func updateGrubConfigForVerity(rootfsVerity imagecustomizerapi.Verity, rootHash
 		return err
 	}
 
-	formattedCorruptionOption, err := systemdFormatCorruptionOption(rootfsVerity.CorruptionOption)
+	formattedCorruptionOption, err := SystemdFormatCorruptionOption(rootfsVerity.CorruptionOption)
 	if err != nil {
 		return err
 	}
@@ -230,7 +230,7 @@ func systemdFormatPartitionId(configDeviceId string, mountIdType imagecustomizer
 	}
 }
 
-func systemdFormatCorruptionOption(corruptionOption imagecustomizerapi.CorruptionOption) (string, error) {
+func SystemdFormatCorruptionOption(corruptionOption imagecustomizerapi.CorruptionOption) (string, error) {
 	switch corruptionOption {
 	case imagecustomizerapi.CorruptionOptionDefault, imagecustomizerapi.CorruptionOptionIoError:
 		return "", nil

toolkit/tools/pkg/osmodifierlib/modifierutils.go

@@ -37,43 +37,80 @@ func doModifications(baseConfigPath string, osConfig *osmodifierapi.OS) error {
 		return err
 	}
 
-	if osConfig.Overlays != nil {
-		bootCustomizer, err := imagecustomizerlib.NewBootCustomizer(dummyChroot)
-		if err != nil {
-			return err
-		}
+	err = imagecustomizerlib.AddKernelCommandLine(osConfig.KernelCommandLine.ExtraCommandLine, dummyChroot)
+	if err != nil {
+		return fmt.Errorf("failed to add extra kernel command line:\n%w", err)
+	}
 
+	bootCustomizer, err := imagecustomizerlib.NewBootCustomizer(dummyChroot)
+	if err != nil {
+		return err
+	}
+
+	updateGrubRequired := false
+
+	if osConfig.Overlays != nil {
 		err = updateGrubConfigForOverlay(*osConfig.Overlays, bootCustomizer)
 		if err != nil {
 			return err
 		}
+		updateGrubRequired = true
+	}
 
-		err = bootCustomizer.WriteToFile(dummyChroot)
+	if osConfig.SELinux.Mode != "" {
+		err = handleSELinux(osConfig.SELinux.Mode, bootCustomizer, dummyChroot)
 		if err != nil {
 			return err
 		}
+		updateGrubRequired = true
 	}
 
-	if osConfig.SELinux.Mode != "" {
-		bootCustomizer, err := imagecustomizerlib.NewBootCustomizer(dummyChroot)
+	if osConfig.Verity != nil {
+		err = updateDefaultGrubForVerity(osConfig.Verity, bootCustomizer)
 		if err != nil {
 			return err
 		}
+		updateGrubRequired = true
+	}
 
-		err = handleSELinux(osConfig.SELinux.Mode, bootCustomizer, dummyChroot)
+	if osConfig.RootDevice != "" {
+		err = bootCustomizer.SetRootDevice(osConfig.RootDevice)
 		if err != nil {
 			return err
 		}
+		updateGrubRequired = true
+	}
 
+	// Write changes to file only if GRUB needs updating
+	if updateGrubRequired {
 		err = bootCustomizer.WriteToFile(dummyChroot)
 		if err != nil {
 			return err
 		}
 	}
 
-	err = imagecustomizerlib.AddKernelCommandLine(osConfig.KernelCommandLine.ExtraCommandLine, dummyChroot)
+	return nil
+}
+
+func updateDefaultGrubForVerity(verity *osmodifierapi.Verity, bootCustomizer *imagecustomizerlib.BootCustomizer) error {
+	var err error
+
+	formattedCorruptionOption, err := imagecustomizerlib.SystemdFormatCorruptionOption(verity.CorruptionOption)
 	if err != nil {
-		return fmt.Errorf("failed to add extra kernel command line:\n%w", err)
+		return err
+	}
+
+	newArgs := []string{
+		"rd.systemd.verity=1",
+		fmt.Sprintf("systemd.verity_root_data=%s", verity.DataDeviceId),
+		fmt.Sprintf("systemd.verity_root_hash=%s", verity.HashDeviceId),
+		fmt.Sprintf("systemd.verity_root_options=%s", formattedCorruptionOption),
+	}
+
+	err = bootCustomizer.UpdateKernelCommandLineArgs("GRUB_CMDLINE_LINUX", []string{"rd.systemd.verity",
+		"systemd.verity_root_data", "systemd.verity_root_hash", "systemd.verity_root_options"}, newArgs)
+	if err != nil {
+		return err
 	}
 
 	return nil

toolkit/tools/pkg/osmodifierlib/modifydefaultgrub.go

@@ -16,10 +16,6 @@ var grubArgs = []string{
 	"rd.overlayfs",
 	"roothash",
 	"root",
-	"rd.systemd.verity",
-	"systemd.verity_root_data",
-	"systemd.verity_root_hash",
-	"systemd.verity_root_options",
 	"selinux",
 	"enforcing",
 }